当一个线程使用Open*打开一个内核对象时，会发生什么？

有两种可能：

1. 打开成功，拿到句柄

2. 打开失败

这不是废话么？！为啥打开失败呢？有两种可能：

1. 当前线程不具有指定的特权

2.  权限不足(由dwDesiredAccess参数指定权限)

这个时候就引入了今天的主题：令牌(包含特权列表)和安全描述符(描述用户权限)。

Token

token是什么？对了，他就是一个令牌。就像原先钦差大臣手里面的上方宝剑一样，上可惩天子，下可斩贪官！所以千万不要小看它哦亲~。那Token中都有些神马东东呢？

先看一下他的数据结构：

lkd> dt nt!_token
   +0x000 TokenSource      : _TOKEN_SOURCE
   +0x010 TokenId          : _LUID
   +0x018 AuthenticationId : _LUID
   +0x020 ParentTokenId    : _LUID
   +0x028 ExpirationTime   : _LARGE_INTEGER
   +0x030 TokenLock        : Ptr32 _ERESOURCE
   +0x038 AuditPolicy      : _SEP_AUDIT_POLICY
   +0x040 ModifiedId       : _LUID
   [COLOR="Red"]+0x048 SessionId        : Uint4B[/COLOR]
   [COLOR="Red"]+0x04c UserAndGroupCount : Uint4B[/COLOR]
   +0x050 RestrictedSidCount : Uint4B
   [COLOR="Red"]+0x054 PrivilegeCount   : Uint4B[/COLOR]
   +0x058 VariableLength   : Uint4B
   +0x05c DynamicCharged   : Uint4B
   +0x060 DynamicAvailable : Uint4B
   +0x064 DefaultOwnerIndex : Uint4B
   [COLOR="Red"]+0x068 UserAndGroups    : Ptr32 _SID_AND_ATTRIBUTES[/COLOR]
   +0x06c RestrictedSids   : Ptr32 _SID_AND_ATTRIBUTES
   +0x070 PrimaryGroup     : Ptr32 Void
   [COLOR="Red"]+0x074 Privileges       : Ptr32 _LUID_AND_ATTRIBUTES[/COLOR]
   +0x078 DynamicPart      : Ptr32 Uint4B
   [COLOR="Red"]+0x07c DefaultDacl      : Ptr32 _ACL[/COLOR]
   +0x080 TokenType        : _TOKEN_TYPE
   +0x084 ImpersonationLevel : _SECURITY_IMPERSONATION_LEVEL
   +0x088 TokenFlags       : Uint4B
   +0x08c TokenInUse       : UChar
   +0x090 ProxyData        : Ptr32 _SECURITY_TOKEN_PROXY_DATA
   +0x094 AuditData        : Ptr32 _SECURITY_TOKEN_AUDIT_DATA
   +0x098 OriginatingLogonSession : _LUID
   +0x0a0 VariablePart     : Uint4B

SeAssignPrimaryTokenPrivilege
SeAuditPrivilege
SeBackupPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeCreatePagefilePrivilege
SeCreatePermanentPrivilege
SeCreateSymbolicLinkPrivilege
SeCreateTokenPrivilege
SeDebugPrivilege
SeEnableDelegationPrivilege
SeImpersonatePrivilege
SeIncreaseBasePriorityPrivilege
SeIncreaseQuotaPrivilege
SeIncreaseWorkingSetPrivilege
SeLoadDriverPrivilege
SeLockMemoryPrivilege
SeMachineAccountPrivilege
SeManageVolumePrivilege
SeProfileSingleProcessPrivilege
SeRelabelPrivilege
SeRemoteShutdownPrivilege
SeRestorePrivilege
SeSecurityPrivilege
SeShutdownPrivilege
SeSyncAgentPrivilege
SeSystemEnvironmentPrivilege
SeSystemProfilePrivilege
SeSystemtimePrivilege
SeTakeOwnershipPrivilege
SeTcbPrivilege
SeTimeZonePrivilege
SeTrustedCredManAccessPrivilege
SeUndockPrivilege
SeUnsolicitedInputPrivilege

[COLOR="Blue"]lkd> !process 0 1 windbg.exe[/COLOR]
PROCESS 89031da0  SessionId: 0  Cid: 0c68    Peb: 7ffdb000  ParentCid: 0530
    DirBase: 09f602e0  ObjectTable: e1f25ba0  HandleCount:  86.
    Image: windbg.exe
    VadRoot 88c553c0 Vads 87 Clone 0 Private 2296. Modified 3959. Locked 1.
    DeviceMap e20447c8
   [COLOR="Red"] Token                             e108d258[/COLOR]
    ElapsedTime                       02:26:28.813
    UserTime                          00:00:01.171
    KernelTime                        00:00:06.078
    QuotaPoolUsage[PagedPool]         92740
    QuotaPoolUsage[NonPagedPool]      3600
    Working Set Sizes (now,min,max)  (1803, 50, 345) (7212KB, 200KB, 1380KB)
    PeakWorkingSetSize                3848
    VirtualSize                       60 Mb
    PeakVirtualSize                   61 Mb
    PageFaultCount                    7861
    MemoryPriority                    BACKGROUND
    BasePriority                      8
    CommitCharge                      2704

[COLOR="Blue"]lkd> !token e108d258[/COLOR]
_TOKEN e108d258
TS Session ID: 0
User: S-1-5-21-2025429265-1682526488-1801674531-1005
Groups: 
 00 S-1-5-21-2025429265-1682526488-1801674531-513
    Attributes - Mandatory Default Enabled 
 01 S-1-1-0
    Attributes - Mandatory Default Enabled 
 02 S-1-5-32-544
    Attributes - Mandatory Default Enabled Owner 
 03 S-1-5-32-545
    Attributes - Mandatory Default Enabled 
 04 S-1-5-4
    Attributes - Mandatory Default Enabled 
 05 S-1-5-11
    Attributes - Mandatory Default Enabled 
 06 S-1-5-5-0-5125624
    Attributes - Mandatory Default Enabled LogonId 
 07 S-1-2-0
    Attributes - Mandatory Default Enabled 
Primary Group: S-1-5-21-2025429265-1682526488-1801674531-513
Privs: 
 00 0x000000017 SeChangeNotifyPrivilege           Attributes - Enabled Default 
 01 0x000000008 SeSecurityPrivilege               Attributes - 
 02 0x000000011 SeBackupPrivilege                 Attributes - 
 03 0x000000012 SeRestorePrivilege                Attributes - 
 04 0x00000000c SeSystemtimePrivilege             Attributes - 
 05 0x000000013 SeShutdownPrivilege               Attributes - 
 06 0x000000018 SeRemoteShutdownPrivilege         Attributes - 
 07 0x000000009 SeTakeOwnershipPrivilege          Attributes - 
 08 0x000000014 SeDebugPrivilege                  Attributes - Enabled 
 09 0x000000016 SeSystemEnvironmentPrivilege      Attributes - 
 10 0x00000000b SeSystemProfilePrivilege          Attributes - 
 11 0x00000000d SeProfileSingleProcessPrivilege   Attributes - 
 12 0x00000000e SeIncreaseBasePriorityPrivilege   Attributes - 
 13 0x00000000a SeLoadDriverPrivilege             Attributes - Enabled 
 14 0x00000000f SeCreatePagefilePrivilege         Attributes - 
 15 0x000000005 SeIncreaseQuotaPrivilege          Attributes - 
 16 0x000000019 SeUndockPrivilege                 Attributes - Enabled 
 17 0x00000001c SeManageVolumePrivilege           Attributes - 
 18 0x00000001d SeImpersonatePrivilege            Attributes - Enabled Default 
 19 0x00000001e SeCreateGlobalPrivilege           Attributes - Enabled Default 
Authentication ID:         (0,4e3f87)
Impersonation Level:       Anonymous
TokenType:                 Primary
Source: User32             TokenFlags: 0x89 ( Token in use )
Token ID: 4f3891           ParentToken ID: 0
Modified ID:               (0, 4ffaa5)
RestrictedSidCount: 0      RestrictedSids: 00000000

lkd> dt nt!_Security_Descriptor
   +0x000 Revision         : UChar
   +0x001 Sbz1             : UChar
   +0x002 Control          : Uint2B
   +0x004 Owner            : Ptr32 Void
   +0x008 Group            : Ptr32 Void
   +0x00c Sacl             : Ptr32 _ACL
   [COLOR="Red"]+0x010 Dacl             : Ptr32 _ACL[/COLOR]

[培训]科锐逆向工程师培训第53期2025年7月8日开班！